Merge webkit.org at r58033 : Initial merge by git

Change-Id: If006c38561af287c50cd578d251629b51e4d8cd1

1 files changed, 13 insertions, 19 deletions

diff --git a/WebCore/html/canvas/WebGLByteArray.cpp b/WebCore/html/canvas/WebGLByteArray.cpp
index 1c2849b..603e4d1 100644
--- a/WebCore/html/canvas/WebGLByteArray.cpp
+++ b/WebCore/html/canvas/WebGLByteArray.cpp
@@ -35,7 +35,7 @@ namespace WebCore {
 
 PassRefPtr<WebGLByteArray> WebGLByteArray::create(unsigned length)
 {
-    RefPtr<WebGLArrayBuffer> buffer = WebGLArrayBuffer::create(length * sizeof(signed char));
+    RefPtr<WebGLArrayBuffer> buffer = WebGLArrayBuffer::create(length, sizeof(signed char));
     return create(buffer, 0, length);
 }
 
@@ -47,19 +47,16 @@ PassRefPtr<WebGLByteArray> WebGLByteArray::create(signed char* array, unsigned l
     return a;
 }
 
-PassRefPtr<WebGLByteArray> WebGLByteArray::create(PassRefPtr<WebGLArrayBuffer> buffer, int byteOffset, unsigned length)
+PassRefPtr<WebGLByteArray> WebGLByteArray::create(PassRefPtr<WebGLArrayBuffer> buffer, unsigned byteOffset, unsigned length)
 {
-    if (buffer) {
-        // Check to make sure we are talking about a valid region of
-        // the given WebGLArrayBuffer's storage.
-        if ((byteOffset + (length * sizeof(signed char))) > buffer->byteLength())
-            return NULL;
-    }
+    RefPtr<WebGLArrayBuffer> buf(buffer);
+    if (!verifySubRange<signed char>(buf, byteOffset, length))
+        return 0;
 
-    return adoptRef(new WebGLByteArray(buffer, byteOffset, length));
+    return adoptRef(new WebGLByteArray(buf, byteOffset, length));
 }
 
-WebGLByteArray::WebGLByteArray(PassRefPtr<WebGLArrayBuffer> buffer, int offset, unsigned length)
+WebGLByteArray::WebGLByteArray(PassRefPtr<WebGLArrayBuffer> buffer, unsigned offset, unsigned length)
     : WebGLArray(buffer, offset)
     , m_size(length)
 {
@@ -73,15 +70,12 @@ unsigned WebGLByteArray::byteLength() const {
     return m_size * sizeof(signed char);
 }
 
-PassRefPtr<WebGLArray> WebGLByteArray::slice(unsigned offset, unsigned length) {
-    // Check to make sure the specified region is within the bounds of
-    // the WebGLArrayBuffer.
-    unsigned startByte = m_byteOffset + offset * sizeof(signed char);
-    unsigned limitByte = startByte + length * sizeof(signed char);
-    unsigned bufferLength = buffer()->byteLength();
-    if (startByte >= bufferLength || limitByte > bufferLength)
-        return 0;
-    return create(buffer(), startByte, length);
+PassRefPtr<WebGLArray> WebGLByteArray::slice(int start, int end)
+{
+    unsigned offset, length;
+    calculateOffsetAndLength(start, end, m_size, &offset, &length);
+    clampOffsetAndNumElements<signed char>(buffer().get(), m_byteOffset, &offset, &length);
+    return create(buffer(), offset, length);
 }
 
 void WebGLByteArray::set(WebGLByteArray* array, unsigned offset, ExceptionCode& ec) {